CVE-2026-79674 HIGH

CVE-2026-79674: NLTK 3.10.2 Path Traversal via corpus-reader constructors

Vendor Nltk
Product nltk
Weakness CWE-73
Published August 25, 2026
Last update August 25, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.

Key dates

02Disclosure timeline

August 25, 2026 CVE published
August 25, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-12861 W2S – Migrate WooCommerce to Shopify <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read CVE-2022-2431 Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion CVE-2024-12066 SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2025-9048 Wptobe-memberships <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2022-2638 Export All URLs < 4.4 - Admin+ Arbitrary System File Removal